Validate GPG keys by fingerprint and not by 8-bit key-ID.
This makes exploiting bug #11539 harder, but not impossible
and does not affect existing installations.
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Instead of opening the database again for each lookup,
we will read it into memory on first use and every lookup
after that will be coming from cache.
Reviewed-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
We won't offer a native port to ARMv7 in the near future
and to default to an architecture that is working on these
machines, we select armv5tel as default
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
in function network_equal and network2bin a check for undefined variables were missing.
added them.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
The network_equal function only tested the subnet addresses of two given networks which lead to
errormessages saying "This is the green network"
The fix tests netwok and subnet IP's to fix this
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Change links to www.ipfire.org in WebUI themes since the website
now uses HTTPS.
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Set the default operating mode to "relay" in the Tor WebUI
configuration page.
Running a Tor exit relay may cause legal trouble in some
countries and should not be the default setting to prevent
users from accidentally running an exit router.
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
* bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)
* Malformed X.509 IPAddressFamily could cause OOB read (CVE-2017-3735)
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Fixes CVE-2017-13089
A stack-based buffer overflow when processing chunked, encoded HTTP
responses was found in wget. By tricking an unsuspecting user into
connecting to a malicious HTTP server, an attacker could exploit
this flaw to potentially execute arbitrary code.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Another clickable link for 'proxy.cgi', this time for 'Cache Manager Interface' - this one opens in a new window.
And: This time - hopefully - with correct '_blank'-attribute (deleted the backslashes) - based on current 'next'.
Plus: Deleted some "blind" tabs - found by chance.
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Do not allow credentials being submitted in plaintext to Apache.
Instead, redirect the user with a 301 to the TLS version of IPFire's
web interface.
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
